BitLocker flaws let attackers read encrypted Windows drives

What are the two BitLocker vulnerabilities?

The first one bypasses device encryption outright. According to Microsoft, an attacker could reach all the encrypted data on the disk. They only need a user account on the machine, with no special privileges.

The second comes from a memory management error and lets an attacker get around Secure Boot, the startup protection that normally stops malicious software from loading. Microsoft says this one needs neither an account nor any action from the victim.

Should you be worried?

Not too much. In both cases the attacker needs physical access to the computer, so nothing can be exploited remotely over the internet. That still matters if you lose a laptop or have one stolen. Microsoft rates both flaws "important", one step below "critical", and does not consider exploitation likely. It also says neither was public before the patch, so neither has been used in attacks.

The flaws affect Windows 10, Windows 11 and several versions of Windows Server. It is not the first BitLocker problem this year: similar bugs were fixed last month in what was already a record Patch Tuesday.

How to protect your PC

Install the November security update. Open Windows Settings, go to Windows Update and click "Check for updates". Then restart the computer to finish the installation.